netdev - Re: [RFC net 1/2] net: set skb hash for IP6 TCP reset packet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1500281511.5566.15.camel@edumazet-glaptop3.roam.corp.google.com>
Date:   Mon, 17 Jul 2017 01:51:51 -0700
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Shaohua Li <shli@...nel.org>
Cc:     netdev@...r.kernel.org, davem@...emloft.net, Kernel-team@...com,
        Shaohua Li <shli@...com>
Subject: Re: [RFC net 1/2] net: set skb hash for IP6 TCP reset packet

On Thu, 2017-07-13 at 10:56 -0700, Shaohua Li wrote:
> From: Shaohua Li <shli@...com>
> 
> Please see below tcpdump output:

> The tcp reset packet has a different flowlabel, which causes our router
> doesn't correctly close tcp connection.

This looks a bug in your router, because (IPv6 only) flowlabel is not
part of the tuple identifying a TCP flow.

>   The reason is the normal packet
> gets the skb->hash from sk->sk_txhash, which is generated randomly.
> ip6_make_flowlabel then uses the hash to create a flowlabel. The reset
> packet doesn't get assigned a hash, so the flowlabel is calculated with
> flowi6.
> 
> The solution is to save the hash value for timeout sock and use it for
> reset packet.

I am a bit unsure why we need to add yet another field in TCP timewait
structure, since :

1) flowlabel can vary during a TCP flow lifetime.
2) flowlabel is different unde synflood (each syncookie gets a random
flowlabel), and if 3rd packet comes back from the client to finish 3WHS,
the flowlabel will again be different from the one that SYNACK used.